CVE-2016-9121

go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making it vulnerable to an invalid curve attack.

• CWE-326

• http://www.openwall.com/lists/oss-security/2016/11/03/1Mailing List, Patch, Third Party Advisory
• https://github.com/square/go-jose/commit/c7581939a3656bb65e89d64da0a52364a33d2507Issue Tracking, Patch, Third Party Advisory
• https://hackerone.com/reports/164590Permissions Required
• http://www.openwall.com/lists/oss-security/2016/11/03/1Mailing List, Patch, Third Party Advisory
• https://github.com/square/go-jose/commit/c7581939a3656bb65e89d64da0a52364a33d2507Issue Tracking, Patch, Third Party Advisory
• https://hackerone.com/reports/164590Permissions Required

Published

Mar 28, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9115Heap Buffer Over-read in function imagetotga of convert.c(jp…
• CVE-2016-9116NULL Pointer Access in function imagetopnm of convert.c:2226…
• CVE-2016-9117NULL Pointer Access in function imagetopnm of convert.c(jp2)…
• CVE-2016-9118Heap Buffer Overflow (WRITE of size 4) in function pnmtoimag…
• CVE-2016-9119Cross-site scripting (XSS) vulnerability in the link dialogu…
• CVE-2016-9120Race condition in the ion_ioctl function in drivers/staging/…7.8
• CVE-2016-9122go-jose before 1.0.4 suffers from multiple signatures exploi…
• CVE-2016-9123go-jose before 1.0.5 suffers from a CBC-HMAC integer overflo…
• CVE-2016-9124Revive Adserver before 3.2.3 suffers from Improper Restricti…
• CVE-2016-9125Revive Adserver before 3.2.3 suffers from session fixation, …
• CVE-2016-9126Revive Adserver before 3.2.3 suffers from persistent XSS. Us…
• CVE-2016-9127Revive Adserver before 3.2.3 suffers from Cross-Site Request…